Record-keeping and Documentation

Record-keeping is the most mechanically testable section of the standards, because it contains the highest density of exact numbers and enumerated lists. It is also the section where candidates lose marks for the least interesting reason: they know the principle and guess the number.

Two renamings to note: 5.2 is Requests for Reports, not "Failing to Provide Reports", and 5.6 is Record Storage, Security, & Retrieval.

One number governs three standards. Retention is at least 10 years from the date of the last interaction with the client, or 10 years from the client's 18th birthday, whichever is later. It applies to clinical records (5.1), appointment records (5.4) and financial records (5.5), and it survives the closure of a practice (6.4.4). CRPO's own worked example: a client who was seven at the last interaction has their record retained until they are 28.

Competency links: 3.7a (maintain client records), 3.9a and 3.9b (prepare clear, accurate and timely third-party reports and recognise their ethical and legal implications), 2.1a (clear written communication) and 2.1f (differentiate fact from opinion).

5.1 Clinical Records

The rule. Registrants keep an accurate, complete and legible clinical record for each client, and provide access to and disclosure of the records in their custody as permitted or required by law.

What it actually requires

• 5.1.1: an accurate, complete, and legible clinical record for each client.
• 5.1.2: provide access to, and disclosure of, client records in your custody as permitted or required by law.

The required categories. CRPO's web page for 5.1 lists ten categories, and separately requires "a record of client communications" in the clinical record. The current Standards document (revised December 2025) sets client communications out as an eleventh category of its own. Learn all eleven, and do not dismiss communications with the client as a distractor.

Amendment. When an amendment is needed, it should indicate what change was made, when, by whom, and why, while ensuring the original entry remains legible. Four elements plus preservation of the original. Correction fluid, deletion and overwriting all fail this.

A silence to respect. CRPO states no specific deadline for making entries. The expectation is that records are "updated in a timely manner". Do not teach or select a number of days here, and be suspicious of an option that supplies one.

How it appears in a simulation. Typically after a difficult session: a disclosure of risk, an incident in the waiting room, or a decision to end the work.

The +2 option: "Record the client's statements, your observations, the risk assessment you conducted and the plan you agreed, while the session is fresh." Note that the option describes content, not just the act of writing.

The plausible -2 options: "Write a brief note and add the detail once you have discussed the session in supervision on Thursday." Reasonable, and it leaves the record inaccurate and incomplete in the interval when it matters most. Or, after realising a previous entry was wrong: "Replace the entry with a corrected version so the file is accurate." Correction is required; erasure of the original is prohibited.

A clean 0: "Note the session length in your calendar."

The trap. The conscientious therapist writes notes that protect the client's privacy by leaving things out. Minimal notes are not safer notes. 5.1.1 requires complete, and the categories name assessment, consent log, consultations, reports, incidents and the reasons for closing. The second trap is the retrospective tidy-up after something goes wrong: amend openly, showing what changed, when, by whom and why, and leave the original legible.

Who holds the record, in what language, and joint records

Settle custody before the first client. In solo practice the RP is the custodian; in employment, the employer usually is. In group practices and contractor arrangements it can be unclear, so agree in writing, in advance, who holds the records. CRPO's manual has a contractor joining a clinic ask the owner before her first day, not on it, which leaves time to set up a compliant system if the answer is that she is the custodian. When a business relationship ends, the custodian keeps the original unless the record is transferred. If you work at more than one site, keep each site's records separate.

Language. Progress notes may be kept in the language of the therapy, but key information, including the client profile and any summary, is kept in English or French so that other providers can read it in an emergency.

Joint records (couple, family and group therapy). A participant may see the whole record only if all participants consent or request it jointly. Otherwise they receive information about themselves and communal information, such as general themes, that cannot be attributed to another participant. CRPO's example: after a couple separates, one partner asks for the file and the other refuses, so she receives what can reasonably be severed about her own care.

Handling a request. Ask whether the requester has legal authority, whether the client should be warned of risks (for example in litigation), whether severance is needed, whether a summary or report would serve instead, and whether legal advice is needed before opposing a release. The custodian keeps the original and releases copies, unless the law requires the original (for example a police, coroner's or College demand, or a summons), and then keeps a legible copy. Confirming to a non-custodial parent that a child is your client is itself a disclosure.

An insurer asks you to verify a claim. Confirm that the client consented to disclosure for the claim (a signed claim form usually shows it) and share only the minimum, such as whether the sessions took place. Correct an honest error with the client's consent or after discussing it with them. If you suspect fraud, get advice before acting; you may tell the insurer that a receipt is not valid without disclosing health information.

A colleague leaves records incomplete. Responsibility follows the original arrangement: who first held the client, who is the custodian and who now provides care. Work with the departing therapist where that is possible, without pressuring them; otherwise whoever is available completes the record with the information they have and notes why some is missing. An administrator may add non-clinical information as the custodian's agent, under a confidentiality agreement.

5.2 Requests for Reports

The rule. On request, registrants provide a report or certificate relating to treatment within a reasonable time unless there is reasonable cause not to, and they must make clear whether they are giving opinion, stating fact, or summarising what the client told them.

What it actually requires

• 5.2.1: upon request, provide within a reasonable time a report or certificate relating to treatment performed, unless there is reasonable cause not to do so.
• 5.2.2: indicate whether you are providing opinion, stating objective fact, or summarising information provided by a client. Three categories, and the distinction is competency 2.1f.

The number. "Reasonable time" is operationalised as delivering the response within 30 days of receiving the request. Where delay is unavoidable, you must alert the requesting party, explain the reason, and provide a firm completion date. All three.

Fees. You may charge a reasonable fee for preparing a report, but only if you have first given the payer an estimate of the fee. Charges may be based on your pro-rated hourly therapy fee.

The hard limits. Registrants cannot refuse to prepare a requested report simply because the client is unable to pay, or because of a payment dispute. Refusal is limited. CRPO's examples are lacking the competence to provide the information sought (factual information such as treatment dates may still be given), lacking the appropriate consent or legal authorization, and a report that could cause significant harm. The list is framed as examples ("include"), not as a closed set, but a payment dispute is expressly excluded. Where a third party makes the request, verify the authorization.

What else the standard expects. A proper response is "delivered in writing and responds fully to the request, insofar as the registrant is able to do so within their scope of competence": registrants "do not state facts that are outside their knowledge or opine on matters outside their expertise." Before a report that would hold sensitive information goes out, "they should explain to the client the nature of the information that would be included", and "the registrant should document whether the client wishes to proceed with having the report prepared and released." A delay needs a reason. CRPO's examples are a critical piece of information that is unavailable, the registrant's illness, and the need to inform other people, such as a family member who attended some of the sessions; in complex situations the registrant may need time to obtain legal advice. The firm date matters because "Delays (or refusal) to satisfy the request could seriously disadvantage a client."

How it appears in a simulation. The workhorse: a disability insurer, a lawyer or a school requests a report about a client who has an outstanding balance with you, or whose file you have not looked at in a year.

The +2 option: "Confirm that the client has consented to the release, give the payer a written fee estimate, and provide the report within 30 days." A second +2, where delay is real: "Tell the requesting party you cannot meet the usual timeframe, explain why, and give them a firm date by which the report will arrive."

The plausible -2 options:

• "Tell the insurer you will prepare the report once the client's outstanding balance is settled." Named and prohibited.
• "Send the report and invoice the payer at your usual hourly rate afterwards." No prior estimate, which is the one condition on charging.
• "Write that the client 'has post-traumatic stress disorder and is unable to return to work for six months'." Two problems: it presents opinion as fact without labelling it, and it drifts into another profession's act.

A -1: "Include the full clinical record so the insurer has the complete picture." More than was requested, more than is necessary, and a report is not the record. That distinction is defined in 5.3.

The trap. The conscientious therapist believes withholding a report is a legitimate lever in a fee dispute, or that it protects a client from an insurer. Neither is permitted. Refusal is limited to situations such as lack of competence, lack of consent or legal authority, or significant harm, and never a payment dispute. The second trap is the blurred voice: a report that mixes what the client said, what you observed and what you concluded, without signalling which is which. 5.2.2 requires the signalling, and phrases like "the client reports that", "on observation", and "in my opinion" are what earn the mark.

5.3 Issuing Accurate Documents

The rule. Documents a registrant signs or transmits in a professional capacity, or allows others to sign or transmit on their behalf, must contain accurate and complete information.

What it actually requires

• 5.3.1 is a single statement, and its reach is the examinable part: it covers documents you sign, documents you transmit, and documents you allow others to sign or transmit on your behalf. Delegating the administration does not delegate the responsibility.
• Exercise care over the accuracy of information in documents prepared for your signature and transmittal.
• Consider how the reader will interpret the information, and use clear language that minimises the likelihood of it being misconstrued.
• Refuse to sign or send documents containing misleading or false information, and refuse to let others do so on your behalf.
• Issue invoices, bills and receipts that are accurate, which includes listing the correct provider, fee, date, registration number and duration of the services provided.

A definition that matters. A report or certificate is "a letter, summary, or form, whether formal or informal, regarding the treatment of a client. It does not include providing a copy of the client record itself", which is governed by 5.1. Candidates conflate these constantly, and options that offer "the file" in answer to a request for a report are usually negative.

A note on scope. CRPO does not use the words "backdating" or "signing blank forms" in this standard. The concrete anchor is the invoice accuracy requirement. Reason from that bullet rather than from invented examples.

How it appears in a simulation. Almost always an insurance receipt, and almost always with a sympathetic motive: a client's benefits plan covers a service delivered by an RP but not by a student, or the plan year has just turned over, or the session was 30 minutes and the plan reimburses only full hours.

The +2 option: "Issue the receipt showing the name and registration number of the person who actually provided the service, the actual date, the actual duration and the actual fee, and tell the client you can explain the plan's limits if she wants to take it up with her insurer." The revealed response is often disappointing: the client says she will not be able to afford to continue.

The plausible -2 options:

• "Date the receipt to the following week so the sessions fall into the client's new benefit year." Sympathetic, common, and false information on a document you transmit.
• "Issue the receipt in your own name, since you supervise the student who delivered the session." The provider must be identified correctly, and 5.5 separately requires that fees charged by supervised staff be clearly identified.
• "Ask your administrator to prepare and send the receipts, and sign them without review." 5.3.1 covers what you allow others to transmit on your behalf.

A 0: "Give the client a copy of your fee schedule."

The trap. The conscientious therapist reframes an inaccurate document as an act of advocacy for a client who genuinely cannot afford care. The standard has no advocacy exception, and the legitimate routes, a sliding scale under 6.1 or a fee reduction documented under 5.5, are available and compliant. The second trap is passive: signing what the administrator prepared. The document is yours the moment it goes out under your name.

5.4 Appointment Records

The rule. Registrants maintain an appointment and attendance record for each client.

What it actually requires

• 5.4.1: an appointment and attendance record for each client.
• Content: the date, time, and duration of each professional encounter with the client.
• Cancelled or missed appointments are documented. This is the part candidates forget, and it is the part that matters when a late cancellation fee is charged under 6.1 or when attendance is questioned in a report.
• Retention: at least ten years from the last interaction with the client, or from the client's 18th birthday, whichever is later.
• Storage: may be kept centrally, for example in an office calendar or billing system, or inside each client's clinical record. Either way it must be maintained securely to avoid unauthorized or unnecessary disclosure.

The related regulation is the Professional Misconduct Regulation under the Psychotherapy Act, 2007, provisions 25, 26 and 27 (O. Reg. 317/12, s. 1, paras. 25 to 27: failing to keep records in accordance with the standards, signing or issuing a false or misleading document, and falsifying a record).

How it appears in a simulation. Usually as a supporting detail in a fees or reporting section: a client disputes a missed-appointment charge, or an insurer asks how many sessions were attended.

The +2 option: "Check the appointment and attendance record, which shows the date, time and duration of each session and the appointments that were cancelled or missed, and answer from it." The plausible -2: "Estimate the number of sessions from your billing history and confirm it to the insurer." Estimation in a document you transmit is a 5.3 problem as well as a 5.4 one.

The trap. Therapists in solo practice keep attendance in a calendar app, delete cancelled appointments so the week looks tidy, and then cannot evidence the cancellation they charged for. Cancellations and missed appointments are required content, not clutter.

5.5 Financial Records

The rule. Registrants keep a financial record for all clients for whom a fee is charged for therapeutic services.

What it actually requires

A financial record is required wherever a fee is charged. Its contents:

• Clear identification of the person providing the service and their title
• The client's full name, address, and unique identifier if applicable
• A description of the service, the cost, the date, and the method of payment
• Clear identification of fees charged by supervised staff
• The reason or reasons why fees were reduced or waived
• The full name and address of any third-party payer, for example an insurer
• Any outstanding balance owed by the client
• Documentation if a collection agency was retained

Retention: at least ten years from the last interaction with the client, or from the client's 18th birthday, whichever is later, as with clinical and appointment records.

Storage: financial records may be kept separately from clinical records, but they must be maintained with due regard for security and should be easily retrievable.

How it appears in a simulation. A sliding-scale decision, or a client who stops paying.

The +2 option: "Agree the reduced fee with the client, record the reduced amount and the reason for the reduction in the financial record, and confirm the arrangement in writing." The reason is the element candidates drop, and it is expressly required.

The plausible -2 option: "Waive the fee informally for this client and keep the arrangement between the two of you." Kind, undocumented, and it leaves no record of why one client was charged differently from another.

A second -2: "Send the account to a collection agency and remove the balance from your records." Using a collection agency is permitted, and 6.1.8 separately prohibits selling or assigning the debt, and the retention of the record is not optional.

The trap. Fee reductions feel like private acts of generosity that do not belong in a file. In a regulated practice they are exactly the kind of variation that must be explicable, which is why CRPO requires the reason, not just the amount.

5.6 Record Storage, Security, & Retrieval

The rule, verbatim. "Registrants take steps that are reasonable in the circumstances to ensure that personal health information is protected against theft, loss and unauthorized use, disclosure, modification, or disposal."

What it actually requires

Storage and organization

• Develop record-keeping policies, or follow an employer's or group practice's protocols
• Organize records in a logical and systematic fashion to facilitate retrieval and use
• Maintain records that support audit-trail capability

Physical security

• Lock paper records and electronic devices in secure spaces
• Prevent unauthorized viewing of screens displaying personal health information
• Secure disposal of paper, with micro-cut shredding as CRPO's example. A strip-cut shredder leaves strips that can be pieced back together, so it falls short of secure disposal.

Electronic safeguards

• Firewalls, encryption, virus protection and security updates
• User ID and password protection
• Automated backups at reasonable intervals, with recovery tests. Backups that have never been restored are not evidence of anything.
• Audit logs capturing the date, time and author of each entry, including changes that preserve the original entry; who has viewed the record and when; and data exports and exchanges with other systems
• An alternate record-keeping method in case of system failure

Destruction

• Secure deletion of client records once the retention period has ended
• A log to track when files are to be disposed

Administrative safeguards

• Need-to-know access
• Confidentiality agreements with authorized viewers
• Privacy training
• Secure transmission methods during disclosure

Custodianship. The standard applies both to registrants who are health information custodians and to those working inside custodian organizations. Custodians should designate a written successor, with that successor's consent. That requirement connects directly to 6.4.3, which requires custodians to keep the College informed about who would take custody of records in the event of the registrant's death or long-term inability.

How it appears in a simulation. The practice-management vehicle: you are setting up a solo private practice, or your electronic records platform has an outage, or a laptop has gone missing.

The +2 option after a loss: "Promptly notify the client, report to the Information and Privacy Commissioner if the breach falls within the prescribed circumstances, and review what information was on the device." That combines 5.6 with the breach obligation in 3.1. The client is always told; the IPC is told where PHIPA's prescribed circumstances apply, and a theft is one of them unless the information was de-identified or properly encrypted.

The +2 option in a setup scenario: "Establish an alternate record-keeping method to use if the platform is unavailable, and test that backups can actually be restored."

The plausible -2 options: "Store the paper files in a locked cabinet in your home office and shred them with a strip-cut shredder when the retention period expires." Two failures in one sympathetic sentence. Or: "Give the administrator full access to all client files so she can help with retrieval." That is the opposite of need-to-know.

A 0: "Rename the files so they sort chronologically."

The trap. The conscientious therapist treats security as a technology purchase: encrypted platform, strong password, done. The standard is roughly half administrative: need-to-know access, confidentiality agreements, privacy training, a disposal log, a designated successor. Those are the items that go missing in solo practice, and they are the items examiners choose when they want an option that looks unglamorous and is correct.

High-yield facts

Ten-point recall list

1. Ten years, or ten years past the eighteenth birthday, whichever is later. Clinical, appointment and financial records alike, and it survives practice closure.
2. Ten categories plus client communications in the clinical record, ending with a closing note that gives the reasons.
3. Amend, never erase: what, when, who, why, and the original stays legible.
4. No stated deadline for making entries. Be suspicious of an option that supplies a number of days.
5. Thirty days for a report, or an explanation plus a firm completion date.
6. You cannot withhold a report over money. Refusal is limited to situations such as lack of competence, lack of consent or authority, or significant harm.
7. Label your voice: opinion, fact, or what the client told you.
8. Receipts carry the real provider, fee, date, registration number and duration, and you are responsible for what your staff send out under your name.
9. Cancellations and missed appointments are required content, not housekeeping.
10. Record the reason a fee was reduced or waived, and remember that security is half administrative: need-to-know, agreements, training, a disposal log, and a designated successor.